Name: aws-security-review
Author: securityskills

Imported from securityskills/skills (cloud-security/aws/aws-security-review/SKILL.md). Install upstream with npx skills add securityskills/skills --skill aws-security-review. Copyright stays with the author.

AWS Security Review

A structured audit of an AWS account or organization.

1. IAM Deep Dive

Enumerate users, roles, policies (identity + resource + permission boundaries)
Hunt privilege escalation paths: iam:CreatePolicyVersion, iam:PassRole + ec2:RunInstances/lambda creation, sts:AssumeRole chains, iam:SetDefaultPolicyVersion
Wildcard actions/resources on trust boundaries; NotAction with Effect: Allow traps
Unused credentials, access keys older than 90 days, no rotation
Check trust policies: roles assumable by * or by external account IDs

Tools

scoutSuite, prowler, pmapper (privilege escalation graph), cloudsplaining (least-privilege diffs)

2. Exposure Review

S3: public buckets/block public access at account level; ACLs vs bucket policy conflicts
EBS/RDS/redshift snapshots: shared or public
Load balancers/security groups: 0.0.0.0/0 on management ports (22/3389), database ports exposed
API Gateway, Lambda function URLs, Elasticsearch/OpenSearch domains with open access policies

3. Encryption and Data

Default encryption on S3/EBS/RDS; KMS key policies scoped correctly
Secrets Manager vs hardcoded values in env vars committed to IaC
CloudTrail: multi-region, log file validation, no public bucket; GuardDuty enabled

4. Network

VPC flow logs on; NAT gateway vs IGW placement for private subnets
Peering/transit gateway routes leaking ranges
Public subnets hosting workloads that should be private

5. Workload Identity

EC2 instance profiles over long-lived keys; EKS IRSA / pod identity
Tasks/containers without privileged modes; metadata service v2 enforced

Output

Ranked findings: exposure (public data/ports), privilege escalation chains (with pmapper-style path evidence), logging gaps, and remediation mapped to specific policy/resource ARNs.

{ "ocm": "1", "id": "securityskills-skills-aws-security-review", "kind": "skill", "name": "aws-security-review", "description": "Audit AWS environments for IAM privilege escalation, exposed resources, logging gaps, and misconfigurations across accounts. Use for cloud security assessments and hardening reviews.", "publisher": "securityskills", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "skills-sh" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Audit AWS environments for IAM privilege escalation, exposed resources, logging gaps, and misconfigurations across accounts. Use for cloud security assessments and hardening reviews." ], "primary": false, "metadata": { "source": { "provider": "skills.sh", "repository": "https://github.com/securityskills/skills", "path": "cloud-security/aws/aws-security-review/SKILL.md", "ref": "HEAD", "url": "https://github.com/securityskills/skills/blob/HEAD/cloud-security/aws/aws-security-review/SKILL.md", "key": "securityskills/skills/cloud-security/aws/aws-security-review/SKILL.md" } }, "instructions": "# AWS Security Review\n\nA structured audit of an AWS account or organization.\n\n## 1. IAM Deep Dive\n\n- Enumerate users, roles, policies (identity + resource + permission boundaries)\n- Hunt privilege escalation paths: `iam:CreatePolicyVersion`, `iam:PassRole` + `ec2:RunInstances`/lambda creation, `sts:AssumeRole` chains, `iam:SetDefaultPolicyVersion`\n- Wildcard actions/resources on trust boundaries; `NotAction` with `Effect: Allow` traps\n- Unused credentials, access keys older than 90 days, no rotation\n- Check trust policies: roles assumable by `*` or by external account IDs\n\n### Tools\n- `scoutSu", "cost": { "context_tokens": 465 } }

aws-security-review

About